8.1Yüksek
KEV
CVE-2018-6961VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
Aktif olarak istismar ediliyor — VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 25.03.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.04.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-6961
Açıklama
VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.
Zayıflık türü (CWE):
CWE-78
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| VMware | NSX SD-WAN by VeloCloud | prior to version 3.1.0 |
Kaynaklar ve yamalar
- 104185 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 44959 exploitExploitThird Party AdvisoryVDB Entry
- 1041210 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- http://www.vmware.com/security/advisories/VMSA-2018-0011.html Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6961 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:vmware:nsx_sd-wan_by_velocloud:*:*:*:*:*:*:*:*< 3.1.0